 
 (def wrap-auth (m/wrap-jwt-authorization {:issuer "keycloak"} {:issuer "auth0"}))
 
-#_(deftest wrap-auth-test
+(defn update-auth-roles [o]
+  (assoc o :auth-roles (keycloak/claimed-roles (:jwt-claims o))))
+
+(deftest wrap-auth-test
   (testing "GET / without claims"
     (let [response ((wrap-auth test-handler)
                     (immutant-request :get "/"))]

    (check-response
     ((wrap-auth test-handler)
      (-> (immutant-request :get "/api/resource")
          (assoc-in [:jwt-claims "realm_access" "roles"]
                    ["akvo:lumen:t0"])))
     403))

  (testing "GET resource with claims and tenant"
    (check-response
     ((wrap-auth test-handler)
      (-> (immutant-request :get "/api/resource")
          (assoc-in [:jwt-claims "realm_access" "roles"]
                    ["akvo:lumen:t0"])
          (assoc :tenant "t0")))
     200))

  (testing "GET resource as admin with claims and tenant"

          (assoc-in [:jwt-claims "realm_access" "roles"]
                    ["akvo:lumen:t0"
                     "akvo:lumen:t0:admin"])
          (assoc :tenant "t0")
          update-auth-roles))
     200))

  (testing "GET admin resource as admin with claims and tenant"
